The base permission mask contains the permissions the object had when it was given to the current owner. In theory, no other mask can have more permissions then the base mask. (If they do, this is a bug in permissions and should be reported.)